Detection for Operation Chain: Histogram Equalization and Dither-like Operation

Abstract

Many sorts of image processing software facilitate image editing and also generate a great number of doctored images. Forensic technology emerges to detect the unintentional or malicious image operations. Most of forensic methods focus on the detection of single operations. However, a series of operations may be used to sequentially manipulate an image, which makes the operation detection problem complex. Forensic investigators always want to know as much exhaustive information about a suspicious image's entire processing history as possible. The detection of the operation chain, consisting of a series of operations, is a significant and challenging problem in the research field of forensics. In this paper, based on the histogram distribution uniformity of a manipulated image, we propose an operation chain detection scheme to identify histogram equalization (HE) followed by the dither-like operation (DLO). Two histogram features and a local spatial feature are utilized to further determine which DLO may have been applied. Both theoretical analysis and experimental results verify the effectiveness of our proposed scheme for both global and local scenarios.

1. Introduction

With the development of multimedia and network techniques in the last two decades, digital media and social networks have become prevalent. The popularization of portable instruments and social software accelerates these tendencies in daily life. From these digital media, we can acquire news, entertainment and advertising information, etc. Currently, digital media play a key role in making important decisions in news media, law enforcement and government organizations. However, numerous image editing softwares can be used to modify digital images easily, which makes the authenticity of digital media significant and to-be-proved. Therefore, digital forensics techniques are emerging to meet the urgent demand.

The primary goals of digital image forensics are to determine whether an image is forgery [1, 2] and, further, to reveal the entire processing history [3]. A number of researchers have exploited many distinct fingerprints to detect specific manipulations [4], e.g., resampling [5, 6, 7], median filtering [8, 9], contrast enhancement [10, 11], JPEG compression [3], etc. A large number of operation detection studies concentrate on designing a specific detector to reveal a specific single operation, while an image may have undergone a series of operations (an operation chain) in real forensic scenarios.

Operation chain detection is a complex and challenging problem. The features of sequential different operations coexist and affect each other, and the types and order of the operations are hardly detectable in the results. A straightforward detection scheme consists of applying state-of-the-art single operation detection methods separately in the operation chain scenario. The success of this scheme relies on the robustness of the single operation detectors against subsequent operation. M.C. Stamm et al. [12] proposed a conditional fingerprint to determine the order of operations consisting of contrast enhancement followed by resizing. For an image undergone contrast enhancement followed by resizing, the conditional fingerprint is extracted from the pixels that are preserved untouched after resizing. In other words, the conditional fingerprint is equivalent to the well-known fingerprint of contrast enhancement [10]. Because the original fingerprint of contrast enhancement lacks robustness, this method is sensitive to the scaling factor, which influences the number of the pixels reserved contrast enhancement feature. A reverse engineering method has been developed to detect another operation chain: double JPEG interposed by resizing [16]. Their method is based on the observation that a decompressed JPEG image trends to be the near lattice distribution (NLD), which is maintained after resizing and subsequent recompression. For each estimated resizing factor, the tested image was reversely resized, and a measure of the NLD was computed. Images with an NLD value above a specific threshold are judged to have undergone this operation chain. For discriminating different image sources in steganalysis, [13] proposed a framework consisting of existing JPEG decompressed identifier followed by two corresponding steganalyzers.

An alternate scheme for operation chain detection consists of modeling the change of the distinct features introduced by one operation due to other operations, even exploiting those new distinct features of the operation chain. Conotter, V. et al. [14] observed that the DCT coefficients of an image, which has undergone JPEG followed by linear filtering, present a specific probabilistic distribution. As a result, the operation chain (JPEG followed by linearly filtering) can be detected by measuring the distance between the DCT distribution of derived models and the actual distribution of the tested image. The authors make the assumption that the compression quality factors are known as a priori. To overcome this shortcoming, a set of features extracted from the DCT distribution was used to train a classifier to detect the same operation chain [15]. P. Ferrara et al. [17] applied the peak-to-valley artifact and specific distribution of the first digit of DCT coefficients to identify the operation chain, i.e., double JPEG interposed by contrast enhancement. In this chain a linear contrast enhancement is applied to each DCT coefficient of the JPEG image, with the result that the DCT distribution presents a periodicity related to the parameter of the contrast enhancement.

In this paper, we focus on detecting the operation chain consisting of histogram equalization and a dither-like operation, i.e., HE-DLO. HE is a general image editing operation and a step in creating forgery photos, which is often used to enhance the details of the lighter or darker regions of an image. To create a forgery image, some post-processing, such as filtering and resampling, may need to be performed after applying HE to make the image more consistent, and the HE image is usually stored in JPEG format. These operations, including filtering, resampling and JPEG compression, etc., have the common characteristic that these operations result in dithered gray values. Thus, some forgery images created in this manner can be identified by detecting the HE-DLO operation chain.

More specifically, we will analyze the difference between the histogram of an image that has undergone HE and that of an image manipulated by the HE-DLO. We observe that applying DLO to a histogram equalized image results in a more uniform histogram effect, which can be used to develop the fingerprint of the HE-DLO operation chain. Two features are proposed to describe the specific fingerprints, i.e., the uniformity and centroid of the histogram, to determine if such an operation chain exists. Then, the combination of our two features and the local binary pattern (LBP) feature can further identify the specific DLO that has been utilized. Our scheme can be applied to cut-and-paste forgery detection to estimate the location of the tampered region.

The rest of the paper is organized as follows. In Section 2, we present the histogram character of the HE-DLO operation chain. We analyze the histogram characteristics of two cases, HE and the HE-DLO operation chain in Section 3 and then propose our features to detect the operation chain in Section 4. In Section 5, we present the performance result of the new approaches for detecting both globally and locally applied HE-DLO. Finally, we conclude this paper in Section 6. To simplify the notation, we denote the histogram-equalized image and the image that has undergone HE-DLO as the HE image and HE-DLO image, respectively.

 

2. Character of HE-DLO Chain

The aim of this work is to study the trace left behind due to the HE-DLO operation chain. We will firstly review the HE operation. Contrast enhancement can be effectively used not only to improve the lightness and darkness of overexposed and underexposed images but also to preprocess an image or a contiguous set of pixels to create a forgery image. Widely used HE is a specific contrast enhancement operation; it has the advantage of making gray-level values span the entire gray range automatically without requiring a parameter option. HE is essentially a gray value mapping from the pixel values in the original image to that in the HE image using the cumulative distribution function (CDF). It can be calculated according to the following equation:

where round(·) denotes the rounding function; hX (n) is the n th bin of the gray-level histogram of the original image, i.e., the number of pixels equal to n ; and N is the total number of pixels; x ,y are the gray values in the original and HE image, respectively. Given an image, pixel-level x is mapped to pixel-level y, which is determined by the number of pixels corresponding to gray value less than or equal to x in the original image. Fig. 1 (a) and (b) indicate the gray-level histogram of the Lena image and its HE version.

Fig. 1.Gray level histogram of (a) a Lena image and (b) the HE version. The histogram of (c) the original image that has undergone uniform noise and that of (d) the HE image manipulated by uniform noise, where noise~u[-1,1]. The histogram of the HE image manipulated by (e) median filter 3×3 and by (f) gamma transformation (r=1.7).

After being enhanced by HE, the image is likely to be manipulated by DLO unconsciously or maliciously [18]. Specifically, each sample may be altered to a minor degree or recalculated with the consideration of adjacent samples by DLO operation. For the latter, because of the high correlation of adjacent pixels, the recalculated pixel should be similar to the original one. These two cases are equivalent to introducing a dither to the pixel. Therefore, the corresponding gray levels are dithered in the histogram. Both low-pass (LP) and high-pass (HP) filters, e.g., Average, Gaussian and Laplacian filters, possess this effect. Even Resampling and JPEG belong to these types of operation. The inevitable processing of these two operations, i.e., interpolation and quantization, separately play a common role in dithering the pixel value.

We model the process of applying DLO as adding uniformly distributed noise over the interval [-1, 1]. Fig. 1 (a)-(d) illustrates the histograms of the Lena image, the HE version, the adding uniformly distributed noise version and the HE image manipulated by adding uniformly distributed noise. From Fig. 1 (b), we observe that the histogram has been stretched to span all possible gray value but still keep the envelope similar to that of the original one. As indicated in Fig. 1 (c), adding a weak uniformly distributed noise to the original image is not a valid way of changing the envelope of the histogram. In Fig. 1 (d), although the histogram retains the shapes of the highest peaks, an approximately uniform distribution histogram emerges. The same phenomenon can be found if the other DLO is applied to the HE image. It seems that HE images followed by a post-operation have a more uniform histogram. Nevertheless, not all post-operations following HE can lead to a uniform histogram, e.g., Median Filtering and the Pixel value mapping operation. Fig. 1 (e) and (f) display the histograms of the HE image manipulated by median filter and gamma correction, respectively. Their envelopes remain similar to that of the HE image. Therefore, the operation chain consisting of HE followed by DLO leads to the generation of the uniform histogram. In the next section, we will analyze and quantify this distinct fingerprint.

 

3. Histogram Distribution Analysis of HE and HE-DLO images

The gray-level histogram of an unaltered image can be determined based on the light intensity reflected from the real world. It can be proven that its histogram is interpolatably connected [10], but it cannot be proven to exhibit a uniform distribution. Moreover, except for gray value mapping, general operations change the histogram distribution only minimally and cannot increase the uniformity of the histogram. To the best of our knowledge, HE can alter the histogram distribution and bring the histogram close to the uniform distribution. We compare the capability to equalize the histogram between the HE operation and HE-DLO operation chains. In this section, we study the histogram uniformity induced in these two cases. The similarities between histogram distributions and the ideal uniform distribution are analyzed individually. Specifically, the general histogram bin is estimated and applied to compare to the bin of the ideal uniform distribution histogram.

3.1 The Histogram Uniformity of the HE Image

The uniform histogram is a basic assumption in the HE detection method [10]; in fact, the disappearance and merging of the gray-level often make the histogram far from uniform [11]. The authors of [19] also indicate that it cannot be proved, in general, that histogram equalization will produce a uniform distribution histogram. Thus, the histogram uniformity of the HE image remains an interesting and significant problem.

Without loss of generality, we take an example to demonstrate the gray-level mapping from the original image to the HE image. We denote hX and hY as the histograms of the original image and HE image. It can be seen from Fig. 2 (a) that one or several gray bins in the histogram hX are mapped or merged to one bin in hY. Take three adjacent nonzero gray-levels in hY, i.e., yk, yk+1 and yk+q as examples, the former two gray-levels can be calculated by Eq. (1) as follows:

where k is the maximum possible gray-level mapped to yk, 1 is the difference between yk and yk+1, 1, m ∈ Z+, and k + m is the maximum possible gray-level mapped to yk+1. It is similar to Fig. 2 (a), yk is mapped by at least the gray-level k, and yk+1 is mapped by the gray-levels k + 1, ⋯, k + m.

Fig. 2.Example graph indicating (a) gray-level mapping of the original image to the HE image, (b) the introduction of yg into the histogram of the HE image and (c) the variation of yg in the histogram of the HE-UN image.

In other words, the bins hX (k + 1), ⋯, hX (k + m) all contribute to forming the bin yk+1. Meanwhile, some zero-height bins, i.e., the gap bin, are introduced in yk. Specifically, if hX (k + 1) is sufficiently large, the interval between yk and yk+1 may be larger than one, i.e., l ≥ 2, one or more gaps between hY(yk) and hY(yk+1) are introduced, as indicated in Fig. 2 (b).

To investigate the histogram of the HE image, the following two easily proven lemmas are first considered:

Lemma 1: Given a ∈ R and A ∈ Z

Lemma 2: Given a,b ∈ R and A,C ∈ Z

round(a + b) = C and round(a) = A, Hence

Given yk+1 - yk = 1, Based on Eq. (2), Eq. (3) and inequality (5), we obtain

Because the inequality (6) can be rewritten as

We normalize the histogram as HY (yk+1)

Thus, the probability range of yk+1 is related to 1, increasing with the increase of 1.

In probability theory and statistics, the discrete uniform distribution takes on a finite number of values with equal probabilities. Each bin of the ideal uniform histogram with 256 gray levels has probability 1/256. The difference between each bin of the normalized histogram of the HE image and that of the ideal uniform histogram can be analyzed as follows. According to the relationship between the HY (y) and 1/256, we divide the bins in hY into three types, i.e., the gap bin, the normal bin and the high bin, denoted as yg, yn and yh, respectively. If HY (y) = 0, we call the bin yg. If HY (y) ∈ (0,2 / 255), we call the bin yn. Because the high bin is mapped by at least one bin in the original image histogram, overhigh bins are rare. The average numbers of bins larger than 4/255 in the normalized histogram are calculated from the 1338 image from the UCID database. The result indicates that only 1% of the 256 bins are larger than 4/255. Thus, we denote yh as HY (y) ∈ [2 / 255,4 / 255).

Because the height value of yn bin distributes around 1/256, the normal bins bring the histogram close to uniform distribution. Although HE enlarges the gray-level range, it cannot increase the gray-level; thus, a number of zero bins are introduced in the histogram of the HE image. Additionally, yg is less than 1/256, and yh is far greater than 1/256. Consequently, the gap and high bins make the histogram of the HE image far from a uniform distribution. The number of these three type bins for the Lena image manipulated by HE are calculated and displayed in the first row of Table 1. The sum of the gap and high bins is approximately half of all 256 bins. As indicated in Fig. 1 (b), the histogram of the HE image maintains a similar envelope to the original image.

Table 1.Numbers of three types of the histogram bins of the HE and HE-RS Lena image

3.2 The Histogram Uniformity of the HE-DLO Image

For the sake of simplicity, we model the DLO application process as the addition of noise to investigate the variation of the histogram uniformity of the HE-DLO image. However, adding strong noise can destroy both perceptual image quality and the histogram, making the histogram uniform. Hence, we select weak noise, which cannot ruin the histogram distribution by itself. Therefore, we take into account the addition of uniformly distributed noise with the interval [-1, 1], i.e., noise~u[-1,1]. The noise makes each of the gray value z spread by the uniform distribution over the range [z - 1, z + 1]. The probabilities of gray values falling into z - 1 th bin, z th bin and z + 1 th bin are 1/4, 1/2 and 1/4, respectively. We abbreviate uniform distribution noise as UN, the operation chain in which the image is manipulated by HE and then by UN as is abbreviated as HE-UN, and hY' represents the histogram of the HE-UN image.

We use 1 = 2 as a concrete example to analyze the bins in hY'. The hY (yg) between yk bin and yk+1 bin is transformed to hY' (yg) due to the addition of UN, as indicated in Fig. 2. (c). The HY (yg) can be calculated as follows:

In this case, the inequality (8) can be rewritten as

According to whether the left adjacent bin of yk is normal or high, yk can be determined to belong to one of the following two ranges. If yk is a normal bin, then

Substituting inequality (10) and (11) into formula (9), yields

If yk is a high bin, then

Substituting inequality (10) and (13) into Eq. (9), we can obtain

Eq. (12) and Eq. (14) indicate that the probability of the gap bin in hY' is closer to 1/256 than that in hY.

From the definition of yh, it can be easily concluded that yh must follow yg. We assume that yk+1 is yh. The HY' (yh) can be calculated in terms of whether the right adjacent bin yk+q is a gap.

If yk+q is a gap bin, HY' (yh) = HY (yh) / 2

If yk+q is not a gap, yk+q is a normal bin, so

The value of HY' (yn) can be estimated in the same manner. The possible probability range of normal bins varies slightly according to the two adjacent bins. With the addition of the inequality (12), (14), (15) and (16), we can determine that the gray-level bins in the HE-UN image normalized histogram are all clustered at the 1/256 than that in the HE image, as indicated in Fig. 3. The probabilities of three types of bin in the HE image and HE-UN image are indicated as red bars and blue bars, respectively. Although the probability range of the normal bin is enlarged to a certain degree, the probability ranges of the other two bins are closer to the ideal uniform distribution after applying HE-UN. The numbers of these three types of bin are calculated for the Lena image that has undergone HE-UN and displayed in the second row of Table 1. The gap and high bins are all transformed to normal bins. The interference of the gap and high bins is drastically reduced by HE-UN.

Fig. 3.The probabilities of the normal, gap and high bin in the HE image and HE-UN image are indicated as red bars and blue bars, respectively. The purple line is the uniform distribution baseline.

Consequently, the histogram of the HE-DLO image is closer to the uniform distribution than the HE image. The theory studied in this section can be generalized to continuous gap bins presented in the histogram of the HE image. As long as the strength of the noise is sufficiently high, the gap bins can be filled, and the high bins can be partially removed. Additionally, given a Gaussian noise with δ=0.5, the probabilities of gray values falling into each bin and its two adjacent bins in the gray-level histogram are 68.2%, 15.7% and 15.7% (according to the three sigma rule), respectively. The tendency of the uniform histogram can be obtained in the same manner.

After manipulated by HE-DLO operation chain, the gap and high bins are undermined, and a more likely uniform histogram emerges due to the combination of two operations. The uniform histogram can be used as an identifying feature to detect the HE-DLO operation chain.

 

4. Proposed forensic approach

According to the above results and discussions, we propose two histogram features to characterize the uniformly distributed histogram; and then, a local spatial feature is proposed to capture the statistical trace left by every operation chains consisting of the HE and a different DLO. These features are described as follows.

4.1 Uniform Histogram Metric

Because the digital images have discrete quantities and the general operation cannot perform as one-for-many gray mapping, even HE cannot leads to a uniform histogram, as proven above. We believe that the most likely uniform distribution histogram is a specific characteristic of HE-DLO. The mean absolute difference between the normalized histogram and the constant value 1/256 is calculated to capture this feature. The scalar metric of uniform histogram is defined as

where h(s) is the s th bin of the gray-level histogram of the image and N is the total number of pixels in the image. τ + 1 and φ are the thresholds chosen to eliminate the numbers of continuous gap bins and the height of overhigh bins to reduce the disturbance of bins far from uniform distribution. Because the DLO dithering range is limited, not all continuous gaps can be filled, especially gaps without nonzero adjacent bins. The overhigh bins directly corresponding to the continuous gaps are difficult to transform to normal bins after weak dithering. Additionally, these two cases can also be introduced by the saturation effect, which causes an impulsive peak in the histogram of original image. Thus, the histogram of a saturated image that has undergone HE-DLO contains a number of continuous gaps and overhigh bins, resulting in a higher MUH than the ideal uniform histogram. Thus, our scheme must eliminate these sources of interference. After calculating the MUH for a suspect image, the detection result can be obtained by a thresholding classification. The images with MUH values less than the decision threshold are to be judged to be HE-DLO images.

4.2 Histogram Centroid

Fig. 4 illustrates two histograms of the Lena image that has undergone HE and the addition of Gaussian noise using standard deviations of δ=0.5 and 0.8. In Fig. 4 (a) the gaps have been partially filled, and the high bins have been partially removed, producing what we refer to as a comb-shaped histogram. Simultaneously, the envelope of the histogram tends toward the uniform distribution. As the strength of the noise increases, the envelope of the histogram approaches a similar uniform distribution, as shown in Fig.4 (b). Based on this observation, we believe that the comb-shaped histogram is an additional distinct fingerprint of HE-DLO. The comb shape is a transitional shape between the histogram of the HE image and the HE-DLO image. The capability to fill the gap and remove the peak is constrained such that the tendency of the uniform histogram is obstructed, which makes the MUH feature unremarkable.

Fig. 4.Gray-level histogram of the Lena image that has undergone HE and Gaussian noise with (a) δ=0.5 and (b) δ=0.8,

To characterize this specific feature, we consider the histogram to be a thin plate with uniform density. The histogram centroid (HC) is introduced to measure the height of the histogram envelope [20]. For the histogram of the unaltered image, its height can be preserved by one-for-one gray-level mapping, and it can even be increased by many-for-one mapping after manipulated by HE. The gap bins does not contribute to the alteration of this height. Therefore, the HC of the HE image histogram is higher than that of the unaltered image. The entire histogram decreases to an approximately uniform distribution due to HE-DLO, such that the lower HC indicates the characteristic fingerprint of HE-DLO. The rank of the low HC will be proven later. In addition, as with the histogram of any image, the distance between the centroid and the y axis is approximately the center of [0, 255]; hence the x coordinate of HC cannot be a unique fingerprint of the HE-DLO. The y coordinate of HC are selected to be a distinct fingerprint of the HE-DLO, which is defined as

where n is the maximum possible gray level with n=255, and H(i) is the i th bin of the normalized histogram. Because we can rearrange the HC expression as follows:

Minimizing HC can reveal the relationship between each bin’s probability and the ideal uniform distribution. This optimization problem has the following structure:

Using Lagrange multipliers, this problem can be converted into an unconstrained optimization problem:

We compute the partial derivative of the unconstrained problem with respect to each variable and let them equal zero. The solutions of these equations are {H(0),H(1),⋯,H(n)} = 1 /(n + 1). Thus, the centroid of the uniform distribution histogram should decrease to the lowest height from the x axis. Therefore, the lower HC indicates a histogram is closer to uniform distribution.

To distinguish between the histogram of the HE and HE-DLO images, we preprocess the histogram to fill the gap bin with μ / 256 and then remove bins that are far greater than their adjacent bins using a min filter with window size 1 × Φ. Finally, the decision threshold can be selected according to the user’s expectation of the accepted false alarm rate. An image with an HC less than the decision threshold is to be judged to be an HE-DLO image.

4.3 LBP Feature

Using the MUH, HC or LR classifier, the HE-DLO operation chain can be identified. However, the specific DLO that has been applied cannot be determined using only the histogram feature. In this subsection, a local spatial feature is considered to capture the unique traces corresponding to different DLOs. Because a DLO can dither the gray value to a minor degree, many image operations can leave footprints in bit planes as well as across bit planes [22]. We infer that the DLO might leave distinct traces mostly in the less-significant bit planes. Similar to spatial filtering, image manipulated by DLO can be modeled as a convolution with a filter kernel in the local region. We regard the footprint left by DLO as a local spatial pattern, which can be characterized using LBP [23] features. LBP features are histograms characterized by the occurrence of specific local patterns. Consider a local neighborhood involving the center pixel gc and its corresponding p equally spaced pixels gp (p = 0, ⋯ P - 1) on a circle of radius R. The local neighborhood centered at every pixel is transformed into a binary pattern using the threshold value of the gray value of the center pixel. Then, the LBP number of the centered pixel is computed by weighting p directional neighbors as where ℓ(·) is the indicator function. For each image a 2p -bin histogram can be obtained based on these LBP numbers. When P = 8, R = 1, 256 possible binary patterns could be calculated, and a 256-bin histogram is generated per image. For example, Fig. 5 displays the 256-bin LBP histograms of the original image and those of its manipulated versions. Notice that the LBP histograms of different HE-DLO have significant discriminating characteristics. Considering that the application DLO is equivalent to a convolution operation, the majority of the transformation kernels have a circularly symmetric architecture. We select the rotation-invariant LBP features i.e., to capture the unique footprints left by different DLO operations.

Fig. 5.LBP histogram for (a) Lena image and for its HE-DLO manipulated version. (b) HE and average filtering with windowsize 3×3. (c) HE and resizing by 1.3. (d) HE and Laplacian filtering use alpha=0.4. (e) HE and JPEG with quality factor 30.

 

5. Experimental Results

This section provides experimental procedures to verify the effectiveness of our proposed features, i.e., the MUH, HC, and LR classifier. Then, the combination of MUH, HC and LBP is used to train a SVM classifier using the LIBSVM tools [24]. The Uncompressed Color Image Database (UCID) [21] is introduced for training and testing. Without loss of generality, the green color layer of each of these images was used to create the training set and testing set. To the best of our knowledge, previous works have not addressed the issues of detecting HE-DLO. Therefore, we cannot compare the performance of our approaches with other methods.

We process 1338 uncompressed original images (ORI) in UCID with single operations or HE-DLO operation chain, using different settings for the window size, variance, gamma value and alpha parameter, as reported in Table 2. We create sets of the images that had undergone single operations, i.e., HE, GC, RS, AVG, GN, LP_G, HP_L, JPEG, generated by manipulating images with HE, gamma correction, resizing, average filtering, Gaussian noise, low-pass Gaussian filtering, high-pass Laplacian filtering and JPEG compression, respectively. Then, the combination of ORI and these eight image sets constitute the ONE database. Additionally, the CHAIN database is introduced, containing the six sets of images that have undergone HE-DLO, i.e., HE-RS, HE-AVG, HE-GN, HE-LP_G, HP_L, HE-JPEG, which are generated by applying resizing, average filtering, Gaussian noise, low-pass Gaussian filtering, high-pass Laplacian filtering and JPEG compression to the HE images, respectively. Based on the capability to fill up the gap bin and remove the high bin, CHAIN is split into two parts, i.e., CHAIN_A and CHAIN_B, to alternatively evaluate the performance of MUH and HC. CHAIN_A consists of applying Gaussian noise δ=0.3, 0.6, 0.9 and Low-pass Gaussian filter [3×3], [5×5], δ=0.35, 0.4 to the HE images, and CHAIN_B is its complement. In other words, the histogram of an image that has undergone CHAIN_A may present a comb-shape.

Table 2.Operations used to create image database

5.1 MUH and HC Detection Result

To evaluate the performance of MUH and HC for HE-DLO detection, experiments were performed on CHAIN_A versus ONE and CHAIN_B versus ONE, respectively. Because the two features are scalar, the measures of MUH or HC extracted from each testing image were used to judge if an image was manipulated by HE-DLO using the decision threshold. The area under the ROC curve (AUC) was employed to indicate the performance of our features and is summarized in Table 3 and Table 4. Table 3 indicates that MUH achieved its best performance using τ = 1, φ = 4. That is to say, MUH can be extracted regardless the continuous gap bins with the number above two and the overhigh bins with height above 4/256. Under these conditions, the AUC of CHAIN_B versus ONE reached 99%, but the AUC of CHAIN_A versus ONE was only 85%. Additionally, the detection performance improved as the value of φ increased and remained stable with different values of τ. This result indicates that excluding the overhigh bin is more important than excluding the continuous zero bins; the former is minimally transformed, and the later can be filled easily. Table 4 indicates that HC achieved its best performance using μ = 1, φ = 3 , i.e., a fill value of 1/256 and a window size of 1×3. As expected, the AUC of CHAIN_A versus ONE reached 98.3%, so HC can complement MUH. The results indicate that filling the gap bin with too large a value or min filtering with too large a window size introduced a disturbance that decreased the detection accuracy. Specifically, filling the gap bin lifted the centroid of the histogram and the min filtering suppressed the centroid of the histogram, which led to false negatives and false positives, respectively. Thus, the AUC is always approximately 93% in the case of CHAIN_B versus ONE.

Table 3.AUC for detection of CHAIN_A vs. ONE and CHAIN_B vs. ONE using MUH

Table 4.AUC for detection of CHAIN_A vs. ONE and CHAIN_B vs. ONE using HC

To assess the suitability of the combination of our two features, i.e., MUH and HC, a logistic regression (LR) classifier for detecting HE-DLO was trained and implement experiments on CHAIN versus ONE. The hypothesis function used for LR is defined as hθ (θ, MUH, HC) = 1 / (1 + e-z). We describe the fitting function z as z = θ0 + θ1 × MUH + θ2 × HC + θ3 × MUH2 + θ4 × HC2 + θ5 × MUH × HC. The parameter vector (θ0,θ1,θ2,θ3,θ4,θ5) can be estimated by minimize the cost function J(θ), i.e., Here the subscript i is the i th sample, m is the number of the sample, y ∈ {0,1} is the classification label, and x is a 2-dimensional feature vector consisting of MUH and HC. The CHAIN and ONE were separated into training and testing database, with sizes of 40% and 60% of the corresponding database size, respectively. The LR model was iterated using the measures of MUH and HC extracted from the images of the training database to find the best parameter vector. The parameter vector and the feature vector extracted from a testing image can be used to determine whether it has undergone HE-DLO. Fig. 6 indicates that the LR classifier presents perfect performance for HE-DLO detection.

Fig. 6.ROC curve for the classification of CHAIN versus ONE using LR classifier

5.2 HE-DLO classification

We demonstrate the performance of LBP in two scenarios. The first scenario is evaluated by applying different LBPs to differentiate six categories of CHAIN. We consider the various combinations of P, R and three LBP features, i.e., uniform LBP, rotation-invariant LBP and uniform rotation-invariant LBP, denoted as The second scenario consists of the application of combined MUH, HC and LBP to differentiate seven classes corresponding to ONE and six categories of CHAIN. The ONE and CHAIN database are split into halves to generate the SVM training and testing sets. An SVM classifier with a Radial Basis Function (RBF) kernel was trained, and the best kernel parameters were found by performing a grid search using a five-fold cross-validation.

The classification accuracy results of the first scenario are summarized in Table 5. LBP achieved its best performance using rotation invariance pattern features with P = 8, R = 1. Under this condition, the summary accuracy reached 86.2%. It can be observed that the “uniform” pattern could not characterize the structure of DLO completely; on the other hand, the “nonuniform” pattern possessed more information for DLO. The results confirm our conjecture that DLO is characterized by rotation invariance, as the process of DLO has a circularly symmetric architecture filter. An additional observation is that the classification accuracies cannot be improved by extending the range of LBP. Therefore, DLO may have left the majority of traces in the immediate adjacent neighborhoods of each pixel rather than the region away from the centered pixel. The results of the classification accuracies of the second scenario are displayed in Fig. 7. Although the number of ONE sets is far larger than the number of CHAIN sets, the classification accuracy of ONE achieves 95.4%, indicating that the feature combination of MUH, HC and LBP is able to differentiate the operation chain image from the original and single operation images very well. In addition, the combination of three features achieves excellent classification accuracy for further determining which image has undergone HE-DLO.

Table 5.Classification accuracies (%) for six HE-DLO

Fig. 7.Classification accuracies (%) for seven classes using the combination of MUH, HC and

5.3 Application to Image Forgery Detection

When performing the forensic detection of HE-DLO, our method can identify whether the full-frame image has gone through an operation chain. In real forensics scenarios, it is more important to authenticate an image if some operation chain has been locally applied, e.g., cut-and-paste forgery forensics. Two classical scenarios can occur through different procedures for forgery image production. The first scenario is that a region from an HE-DLO image is pasted onto a host image. An alternative scenario is that a region from an image processed by HE is pasted onto a host image; then, the composite image is manipulated by DLO. In these two scenarios, the tampered regions can go through HE-DLO, and the complement regions can remain original or undergo HE. In this subsection, the LR classifier is used to determine and locate the tampered region of a forged image. Then, the applied HE-DLO can be determined by the combination of MUH, HC and LBP.

To determine which block sizes are sufficient to implement the blockwise localization forgery region, we performed the following experiment. Blocks of size 300×300, 200×200 and 100×100 were cropped from the center of each of the images from the ONE and CHAIN databases described at the beginning of this section. Then, each block was classified as have been manipulated by HE-DLO or not by the LR classifier using a variety of different thresholds. The ROC curves shown in Fig. 8 indicate that the HE-DLO can be relatively reliably detected using a block size of 300×300. As a result of indicating the global histogram character, the probability of detection decreases with a decreasing block size. When block size is equal to 100×100, the detection rate achieves a random guess.

Fig. 8.ROC curve obtained using different testing block size for images manipulated by HE-DLO

An example of a cut-and-paste forgery image in which the pasted region has gone through HE-RS is displayed in Fig. 9, along with the localized tampered region results obtained from our proposed forensic technique. Fig. 9(a) displays an HE image from which an object (a boy on the right) was cut. Fig. 9(b) displays the unaltered image into which the cut object was pasted. Fig. 9(c) displays the composite image, into which the resized cut object had been pasted with a scaling factor 0.7. Adobe Photoshop was used to composite the forged image. The image was segmented into overlapping pixel blocks with a size of 300×300 and a 16-pixel interval, each of which was tested for evidence of locally applied HE-DLO. Fig. 9 (d) displays the results obtained by performing the classification using the LR classifier. The blocks corresponding to the HE-DLO are boxed and outlined in red. In this example, some parts of the tower present false alarm because these boxes contains varying gray levels, e.g., the black shadow of the tower, the tree beside the tower and the white tower body, which make the histogram similar to a uniform distribution. Then, the feature set of the MUH, HC and extracted from the blocks highlighted by the result of the LR classifier is fed into the SVM classifier, which is trained in the second scenario of Section 5.3. The blocks that are classified into HE-RS and HE-GB are displayed in Fig. 9 (e) and (f), respectively. It can be observed that the main part of the tampered region has been located. In Fig. 9 (f), the classification result is disturbed by the texture of the boy’s sweater, which presents similar blur artifacts, and the possible operation chains have been reduced to two types of HE-DLO. Although our scheme does not resolve the problem of this example, the results we have are desirable.

Fig. 9.Image forgery detection example displaying an object cut from (a) and the histogram equalized image pasted into (b) another unaltered image, (c) the composite image then manipulated by AVG. Blocks detected as having been manipulated by HE-DLO are outlined in red boxes using pixel blocks 300×300 (d) using LR classifier, and then the blocks are further classified as manipulated by (e) HE-RS and (f) HE-LP_G using the combination feature

 

6. Conclusion

In this paper, a new forensic algorithm to detect HE-DLO operation chain applied to a digital image has been proposed. The method is based on distinct histogram distribution and local spatial pattern. Two histogram features were introduced and used to propose a scheme for identifying whether an image has undergone an operation chain. A logistic regression algorithm is trained with these two features to detect HE-DLO. The combination of two histogram features and LBP further distinguishes the HE-DLO image from the original images and their single operation versions. Experiments indicated that MUH and HC provide excellent performance when histograms present uniform distribution and transitional shape, respectively. The LR classifier incorporating the advantages of MUH and HC exhibited perfect detection performance in two scenarios. The results indicate that the combination of MUH, HC and LBP is able to correctly identify traces of different HE-DLO. We extended this technique to a method for detecting locally applied HE-DLO and demonstrated its usefulness for detecting cut-and-paste forgeries.